cti-hyperloop

CTI Hyperloop Framework

The CTI Hyperloop (based on Google/Mandiant's practical implementation framework) extends the traditional intelligence cycle by running it at three levels simultaneously with continuous bidirectional feedback.

Core Concept

Traditional intelligence cycle: linear, single-track, often stuck at the tactical level. Hyperloop: three parallel tracks (strategic, operational, tactical) feeding each other continuously.

STRATEGIC  ←→  OPERATIONAL  ←→  TACTICAL
    ↓              ↓               ↓
Direction → Collection → Processing → Analysis → Dissemination → Feedback
    ↑                                                              |
    └──────────────────────────────────────────────────────────────┘

Intelligence Levels

Strategic Intelligence

• Time horizon: 6-24 months
• Consumers: CISO, Board, Risk Management, Security Architecture
• Focus: Threat landscape trends, emerging threats, geopolitical developments, sector risk posture
• Products: Threat landscape reports, strategic assessments, horizon scanning reports, maturity assessments
• Example PIR: "How will the ransomware threat landscape evolve over the next 12 months and what are the implications for our risk posture?"

Operational Intelligence

• Time horizon: Weeks to months
• Consumers: SOC Manager, IR Lead, Security Operations
• Focus: Active campaigns, threat actor profiling, TTP analysis, vulnerability exploitation trends
• Products: Campaign reports, threat actor profiles, operational assessments, hunt packages
• Example PIR: "What TTPs are currently being used by groups targeting our sector?"

Tactical Intelligence

• Time horizon: Hours to days
• Consumers: SOC Analysts, Detection Engineers, IR Analysts
• Focus: IOCs, detection rules, immediate response support, indicator enrichment
• Products: IOC packages, SIGMA/YARA/KQL rules, flash reports, enrichment reports
• Example PIR: "What IOCs are associated with the current wave of attacks targeting our VPN appliances?"